MPS does not have a policy on executability or provide interfaces to manage it

Ravenbrook / mps

The Memory Pool System

http://www.ravenbrook.com/project/mps

Other

564 stars 77 forks source link

MPS does not have a policy on executability or provide interfaces to manage it #89

Open rptb1 opened 1 year ago

rptb1 commented 1 year ago

The MPS was originally designed as a memory manager for dynamic language run-time systems (what are now often called JITs, whether or not they're "just in time") and as such has defaulted to allocating memory with executable permission. The main commercial user of the MPS is a "JIT" in this sense.

However, this does increase the attack surface for software using the MPS, and the policy ought to be under the control of the client.

Apple's Hardened Runtime now prevents execution by default in the recent macOS version 13 ("Ventura") and though we have a workaround in progress in https://github.com/Ravenbrook/mps/pull/82 we should consider how to handle this issue properly.

rptb1 commented 1 year ago

Investigation and research:

[ ] study Apple Hardened Runtime and the requirements it meets
[ ] investigate if there are similar initiatives on our other target platforms and how they work or will work
[ ] consider the granularity of control that MPS clients might need (global, per arena, per pool class, per pool, per allocation, etc.)
[ ] consider what control we can actually provide given the platforms

I expect this might all come down to a parameter at arena creation, with a possible error code if it can't be fulfilled. Not many lines of actual code.

rptb1 commented 1 year ago

Useful sources (especially in the References):

W^X on Wikipedia
Executable space protection on Wikipedia ("Limitations" mentions JITs)

It's the Harvard Architecture all over again!

I note that we may be able to usefully emulate the restrictions of other OSs with SELinux for testing and development.

rptb1 commented 1 year ago

In https://github.com/Ravenbrook/mps/issues/75#issuecomment-1025102823 @Techcable writes:

I think as a more long term solution, clients that need support for PROT_EXEC on Apple Silicon platforms should explicitly request it.

Resolving this issue should resolve that!

rptb1 commented 1 year ago

In https://github.com/Ravenbrook/mps/pull/77#issue-1118472189 @Techcable writes:

Note that any "proper" solution would still require signficant work to interact with the new Apple APIs for JIT. This means that it is almost certainly going to require some effort on the part of the client, and possibly new APIs on the part of the MPS.

Emphasis mine.